<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>I didn’t set up our LDAP support initially, but it appears to use TLS. I guess it’s possible that it doesn’t actually work.</div><div><br></div><div>jaas.conf</div><div><div style="margin: 0px; font-size: 16px; font-family: 'Courier New'; color: rgb(73, 76, 45); background-color: rgb(255, 254, 230); position: static; z-index: auto;"><span style="color: #000000"> </span>edu.vt.middleware.ldap.jaas.LdapLoginModule<span style="color: #000000"> required</span></div><div style="margin: 0px; font-size: 16px; font-family: 'Courier New'; color: rgb(43, 64, 44); background-color: rgb(255, 254, 230); position: static; z-index: auto;"><span style="color: #000000"> </span><span style="color: #494c2d">ldapUrl</span><span style="color: #000000">=</span>"<a href="ldap://ldap.rutgers.edu">ldap://ldap.rutgers.edu</a> <a href="ldap://ldap2.rutgers.edu">ldap://ldap2.rutgers.edu</a>"</div><div style="margin: 0px; font-size: 16px; font-family: 'Courier New'; color: rgb(43, 64, 44); background-color: rgb(255, 254, 230); position: static; z-index: auto;"><span style="color: #000000"> </span><span style="color: #494c2d">base</span><span style="color: #000000">=</span>"ou=people,dc=rutgers,dc=edu"</div><div style="margin: 0px; font-size: 16px; font-family: 'Courier New'; background-color: rgb(255, 254, 230); position: static; z-index: auto;"> <span style="color: #494c2d">tls</span>=<span style="color: #2b402c">"true"</span></div><div style="margin: 0px; font-size: 16px; font-family: 'Courier New'; color: rgb(73, 76, 45); background-color: rgb(255, 254, 230); position: static; z-index: auto;"><span style="color: #000000"> </span>userField<span style="color: #000000">=</span><span style="color: #2b402c">"uid"</span></div><div style="margin: 0px; font-size: 16px; font-family: 'Courier New'; color: rgb(43, 64, 44); background-color: rgb(255, 254, 230); position: static; z-index: auto;"><span style="color: #000000"> </span><span style="color: #494c2d">serviceUser</span><span style="color: #000000">=</span>“xxxx"</div><div style="margin: 0px; font-size: 16px; font-family: 'Courier New'; color: rgb(43, 64, 44); background-color: rgb(255, 254, 230); position: static; z-index: auto;"><span style="color: #000000"> </span><span style="color: #494c2d">serviceCredential</span><span style="color: #000000">=</span>“xxxx"<span style="color: #000000">;</span></div></div><div><span style="color: #000000"><br></span></div><div><span style="color: #000000"><br></span></div><div><span style="color: #000000">attribute-resolver.xml</span></div><div> <resolver:DataConnector xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"<br> id="myLDAP"<br> ldapURL="<a href="ldap://ldap.rutgers.edu">ldap://ldap.rutgers.edu</a> <a href="ldap://ldap2.rutgers.edu">ldap://ldap2.rutgers.edu</a>"<br><span class="Apple-tab-span" style="white-space: pre;"> </span>baseDN="ou=people,dc=rutgers,dc=edu"<br> principal=“xxxx"<br> principalCredential=“xxxx"<br><span class="Apple-tab-span" style="white-space: pre;"> </span>useStartTLS="true"><br> <FilterTemplate><br> <![CDATA[<br> (uid=$requestContext.principalName)<br> ]]><br> </FilterTemplate><br> </resolver:DataConnector><br><br></div><br><div><div>On Oct 15, 2014, at 4:10 PM, Christopher Bongaarts <<a href="mailto:cab@umn.edu">cab@umn.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On 10/15/2014 2:56 PM, Cantor, Scott wrote:<br><blockquote type="cite">A little quick searching implies to me that the<br>java.naming.security.protocol JNDI property is what controls this in Java,<br>and the only value it appears to have is ssl [1]. Which probably means it<br>doesn't support TLS.<br><br>There is no actual standard for running LDAP over SSL, and I think the way<br>TLS is handled is with StartTLS, and that's probably why Java doesn't<br>support it.<br><br>Daniel probably knows the specifics, but offhand I'd say it's apparently<br>time to dump ldaps or somebody will need to complain to Oracle.<br></blockquote><br>The underlying JSSE support is there (in JDK6 for TLS1.1, JDK7 for <br>TLS1.2), so it might just be a matter of figuring out where to tweak <br>those settings... it's tricky here since we have multiple layers <br>involved (VT-ldap, JNDI, JSSE; plus repeat for the JAAS login handler if <br>you're using it).<br><br>-- <br>%% Christopher A. Bongaarts %% <a href="mailto:cab@umn.edu">cab@umn.edu</a> %%<br>%% OIT - Identity Management %% <a href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%<br>%% University of Minnesota %% +1 (612) 625-1809 %%<br><br>-- <br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></body></html>